afspiegeling/rewards-farmer
1
0
Fork 0
mirror of https://github.com/User0332/rewards-farmer.git synced 2026-09-16 01:31:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

reject profile names that resolve outside data-dir

Browse Source 
The character check allowed "." and "..", which are made entirely of allowed
characters and still walk out of the directory, so the traversal guard only
stopped the cases containing a separator. Reject both by name and check the
resolved path against the profile root as well, since the character set
constrains the characters rather than where they point.

Also drop the MouseUtils and KeyboardUtils built in run_account and never
used, RewardsTaskUtils builds its own, along with the two imports that
leaves unused, and say "lowercased" in the no-source warning, which is what
the code returns.
This commit is contained in:
Ethan Stoner
2026-08-27 15:26:01 -07:00
parent 2f960c6a03
commit 1a224919b2
3 changed files with 23 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/queries.py
+1 -1
View File
@@ -49,7 +49,7 @@ def search_query_for_task(task_description: str) -> str:
# Every feed was unreachable. The description still contains the topic,
# so a trimmed version beats skipping the card entirely.
logger.warning("No query source reachable, using the task description as written.")
logger.warning("No query source reachable, using the lowercased task description.")
return task_description.lower()